Advanced Cryptographic Concepts

What it is

Advanced cryptography answers harder questions: who may hold a key, how data can be used while still encrypted, how both sides prove who they are, and how to keep strong cryptography fast enough. The exam gives a requirement and expects you to pick the matching idea, so learn the problem each one solves and what it costs.

How it works

Key splitting and dual control

Key splitting divides a secret key into parts called shares, held by different people or systems. No single holder can use the key alone. A secret sharing scheme such as Shamir's scheme goes further: any threshold of shares (say 3 of 5) rebuilds the key, while fewer reveal nothing about it.

Dual control means two or more authorized people must act together for a sensitive task, and split knowledge means no one person knows the whole secret. Both are used in key ceremonies, such as loading the master key of a hardware security module (HSM).

One insider or one stolen share cannot expose the key. The cost is process, because enough holders must stay available to recover it.

Homomorphic encryption

Homomorphic encryption lets a system compute on encrypted data and produce an encrypted result. When the data owner decrypts it, the answer matches what the same computation on the plain data would have given. The processing party never sees the plaintext.

Partially homomorphic schemes support only one kind of operation, such as addition, while fully homomorphic schemes support arbitrary computation. A typical use is analytics in an untrusted cloud on data too sensitive to expose. The big drawback is performance: ciphertexts are large and computation is far slower, so it suits narrow, high value tasks.

Secure multiparty computation

In secure multiparty computation (MPC), several parties jointly calculate a result while each keeps its own input private. Only the agreed output is revealed. For example, a group of banks can compute the combined exposure to one customer without any bank sharing its individual figures.

Unlike homomorphic encryption, where one outside party computes, multiparty computation needs repeated message exchange among all parties, so its cost is network traffic and coordination. Both protect data while it is in use. A hardware enclave is a different answer that trusts the chip instead of the mathematics.

Authenticated encryption with associated data

Authenticated encryption with associated data (AEAD) encrypts and authenticates in a single operation. It gives confidentiality and integrity together, and the receiver rejects any message whose authentication tag does not verify. Associated data, such as a packet header, is authenticated but left readable.

Common AEAD ciphers are AES in Galois/Counter Mode (AES-GCM) and ChaCha20-Poly1305, and TLS 1.3 uses only AEAD ciphers. Encryption without authentication lets an attacker modify ciphertext without detection.

Each message needs a unique nonce for a given key. Reusing a nonce with GCM can expose data and allow forged messages.

Mutual authentication

In ordinary TLS only the server proves its identity. In mutual authentication both sides do. With mutual TLS (mTLS) the server also requests a certificate from the client, and the client proves it holds the matching private key.

It is common for service to service traffic, partner APIs and certificate based VPN. The main operating cost is a PKI that can issue, rotate and revoke client certificates, and a stolen client key is a stolen identity.

Hardware acceleration and performance versus security

Cryptography at scale costs processor time. Hardware helps in several ways.

• CPU instructions such as AES-NI speed up AES and reduce timing based leaks.
• TLS offload to a load balancer or card handles handshakes for many connections.
• HSMs perform signing and key operations without exposing keys.

Acceleration matters for busy gateways and encrypted storage. The answer to slow cryptography is faster hardware, not weaker algorithms or shorter keys. An offload device decrypts traffic, so protect it like the servers behind it.